diff --git a/.gitea/workflows/validate-flux.yaml b/.gitea/workflows/validate-flux.yaml
index 88998ac..febe329 100644
--- a/.gitea/workflows/validate-flux.yaml
+++ b/.gitea/workflows/validate-flux.yaml
@@ -13,11 +13,19 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install kustomize
-        # The Gitea act runner image runs as root and has no `sudo`, so install
-        # straight into a writable bin dir instead of `sudo mv … /usr/local/bin`.
+        # The act runner runs as root (no `sudo`). Download a pinned release
+        # tarball directly with retries instead of piping the upstream installer
+        # script through bash — the installer makes extra GitHub API calls that
+        # are rate-limited/unreliable on this runner, and `curl -s` hid the
+        # error (a silent exit 6 = could not resolve host).
+        env:
+          KUSTOMIZE_VERSION: "5.4.3"
         run: |
-          curl -sL "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" | bash
-          install -m 0755 kustomize /usr/local/bin/kustomize
+          set -euxo pipefail
+          url="https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_linux_amd64.tar.gz"
+          curl -fSL --retry 5 --retry-delay 3 --retry-all-errors -o /tmp/kustomize.tar.gz "$url"
+          tar -xzf /tmp/kustomize.tar.gz -C /usr/local/bin kustomize
+          kustomize version
 
       - name: kustomize build flux/
         run: kustomize build flux/ > /dev/null